Queries for the CrowdStrikeDetections table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

High severity detections

Returns count of high severity detections by severity level.

CrowdStrikeDetections
| where MaxSeverity >= 70
| summarize count() by MaxSeverityDisplayName